Is CVE-2026-126614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126614 being exploited in the wild.

How severe is CVE-2026-126614?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.3.3 through 6.3.7.

How is CVE-2026-126614 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-126614?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126614: Progressive Robot hMailServer IP ranges bypass in web services listener

CVE-2026-126614 · Severity: medium · CVSS 5.3 · Published 2026-11-11

hMailServer is an email server that includes a web services listener for accessing email and calendar data. The web services listener does not enforce the same IP-based access controls and login attempt restrictions as the rest of the server, allowing an attacker to guess account passwords indefinitely even after being auto-banned on other protocols. This bypasses the server's built-in brute-force protection, putting email accounts at risk of takeover.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126614 being exploited in the wild.
How severe is CVE-2026-126614?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.3.3 through 6.3.7.
Is there a fix for CVE-2026-126614?: Yes: fixed in 6.3.8 or later (as indicated by advisory stating flaw is fixed in the same release addressing a separate defect). Until then: Disable the web services listener (WebServicesHttpPort and WebServicesHttpsPort set to 0) if not in use. Restrict network access to the web services ports via external firewall rules. Enable AccountLockoutThreshold in hMailServer.ini to enforce per-account lockout independent of the web services listener. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126614 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-126614?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.3.8 or later (as indicated by advisory stating flaw is fixed in the same release addressing a separate defect)

Disable the web services listener (WebServicesHttpPort and WebServicesHttpsPort set to 0) if not in use. Restrict network access to the web services ports via external firewall rules. Enable AccountLockoutThreshold in hMailServer.ini to enforce per-account lockout independent of the web services listener.

Technical details

The web services listener (CardDAV, CalDAV, Outlook Autodiscover) in hMailServer 6.3.3–6.3.7 fails to consult the server's IP range restrictions (AutoBan rules, administrator IP policies) before accepting connections, and does not count failed login attempts toward the auto-ban threshold. An attacker can bypass both IP-level bans and per-account lockout mechanisms by repeatedly attempting HTTP Basic authentication over HTTPS on the web services port, gaining persistent access to guess credentials without being blocked.

Affected products

Progressive Robot hMailServer 6.3.3 through 6.3.7

Timeline

2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.